ACLight.ps1 - False Positive? about zbang HOT 6 OPEN

Hi @ParadoX-SobriuS
For performing DCSync attack you indeed need DS-Replication-Get-Changes permission over the target domin object.
Here are lots of references that talk about DCSync and the replication permissions from the DCs:
https://adsecurity.org/?p=1729 -> read the "Delegating Rights to Pull Account data"
https://adsecurity.org/wp-content/uploads/2016/03/DerbyCon-2015-Metcalf-RedvsBlue-ADAttackAndDefense-Presented-Final.pdf -> slide 60
http://www.harmj0y.net/blog/redteaming/abusing-active-directory-permissions-with-powerview/
https://blog.stealthbits.com/extracting-user-password-data-with-mimikatz-dcsync/
https://blog.fox-it.com/2018/04/26/escalating-privileges-with-acls-in-active-directory/
Etc.

from zbang.

from zbang.

Ok might be, but I think it's still important thing to discover all the accounts with "DS-Replication-Get-Changes" permissions over the root object of the domain, also if they don't have the option of "All" and "Filtered"

from zbang.

I agree that we should fetch the "DS-Replication-Get-Changes" and have this highlighted as a wrong move on that could easily become a catastrophy.
But for the zBang tool, it currectly is a false positive and this is why I reported it as an issue.
There should be a change in the way that the presentation of 'DCSync' is done so that if only "DS-Replication-Get-Changes" is present, it is not a DCSync issue, but rather something like 'DS Replication' and should be considered a Tier1 Account/group

from zbang.

Yes, so I reopened this as a small issue and we will take a look at this. The fix is quite easy, and will be considered to a future version. Thanks @ParadoX-SobriuS

from zbang.

Great and Thanks for an awesome Product!

from zbang.